CVE-2026-66032

Name of the Vulnerable Software and Affected Versions libssh2 versions prior to 1.11.1

Description A double-free issue exists in the sftp open() function within src/sftp.c. This occurs when a malicious SSH server responds to SSH FXP OPEN with SSH FXP STATUS containing FX OK, causing the response data buffer to be freed. If a subsequent sftp packet require() call returns a specific error, such as LIBSSH2 ERROR CHANNEL PACKET EXCEEDED, the same pointer is freed again. On glibc systems, this can lead to tcache dup conditions, which allow for overlapping allocations and the overwriting of function pointers, enabling heap corruption for any authenticated client opening an SFTP session.

Recommendations Update to the version containing commit 5e47761.